Executive brief
Mercury is an AI agent application that executes shell commands on behalf of authenticated users. The shell command permission checker incorrectly classifies `find` commands with dangerous flags (like `-exec`, `-delete`) as safe read-only operations, allowing authenticated attackers to execute arbitrary commands and write files without triggering approval prompts.
Technical details
The vulnerability is an improper authorization flaw in the `PermissionManager.checkShellCommand()` function (src/capabilities/permissions.ts). The code maintains a list of SAFE_READ_PATTERNS that includes `find *` as a harmless read-only pattern, but `find` supports write-capable operators like `-exec`, `-execdir`, `-delete`, `-ok`, and `-okdir` that can spawn subprocesses and modify the filesystem. The validator applies only simple pattern matching and does not perform semantic validation of `find`-specific dangerous flags. When an authenticated user sends a chat message containing `find . -maxdepth 0 -exec sh -c 'command' ';'`, the permission layer incorrectly approves it as safe-read and the command is executed via `spawn(command, [], {shell: true})`, bypassing the normal user approval prompt. This affects Mercury up to version 1.1.13. The attack requires prior authentication to the web interface.
Affected products
- CosmicStack Labs mercury-agent up to 1.1.13
Timeline
- 2026-09-14: disclosed: Published on NVD